Effective 26 September 2026 · Last updated 2 October 2026
This English version is a translation provided for convenience. If it differs from the Thai version, the Thai version applies.
This policy explains what data we collect, why, how long we keep it and what rights you have under Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA). It covers both LINE and the website montratarot.com.
1. Data controller
Montra Tarot (มนต์ตรา ทาโร่), operated by Manatchaya Pongsamrit (มนัชยา พงษ์สัมฤทธิ์)
Email montratarotmkt@gmail.com
2. Data we collect
| Type | Examples | How we get it |
|---|---|---|
| LINE account (if you use LINE) | LINE user ID, display name | From LINE when you add and message us |
| Email (if you order on the website) | Email address, and the nickname you'd like us to use (optional) | You enter it |
| Linking a website order to LINE | Your LINE user ID, linked to your order and email | When you tap "Get my reading in LINE" and confirm in the LINE app |
| Reviews (if you allow us to publish) | Review text, any image you approve, and initials | You send it and agree to publication |
| Your question | The text you write to request a reading | You write it |
| Service data | Cards drawn, package or product chosen, reading delivered, times of use, download history | Recorded automatically |
| Payment data | Amount, time, payment status, payment method | From the payment provider |
| Refund data | Bank account name and number | You provide it when receiving a refund (PromptPay or transfer payments) |
| Technical data | IP address converted to a one-way code (hash) to prevent spam | Recorded automatically when you submit a form |
We never store your credit or debit card number. Card details stay with the payment provider; we only see whether a payment succeeded.
If we refund a PromptPay or bank-transfer payment, we will ask for your bank account number and use it only to send the refund and as an accounting record.
Sensitive data
We do not ask for sensitive data such as health, religious beliefs or sexual behaviour. By the nature of the service, however, you may choose to mention these in your question. Anything you share is used only to prepare your reading and is protected like all other data. If you'd rather we didn't hold such details, please leave them out of your question.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Preparing and delivering the readings or files you order | Performance of contract |
| Sending order confirmations, order-page links and download links by email | Performance of contract |
| Processing payments and refunds | Performance of contract |
| Detecting signs of emotional crisis to send help information | Vital interests |
| Handling complaints and after-sales support | Performance of contract |
| Keeping accounting and tax records | Legal obligation |
| Preventing spam and misuse | Legitimate interests |
| Improving the service | Legitimate interests |
| Sending news and promotions | Consent (withdraw at any time) |
| Publishing your review on the website | Consent (ask us to remove it at any time) |
4. Sharing and transfers outside Thailand
We never sell your data, but we rely on outside providers to run the service, some with servers outside Thailand.
| Provider | Data shared | Location |
|---|---|---|
| LINE | Messages and user ID, to send and receive messages | Per LINE's policy |
| Anthropic (Claude API) | Your question and card meanings, to compose the reading | United States |
| Supabase | Service database, card images, reviews and promotions (your browser loads images and reviews from here directly, so it sees your IP address) | Japan (Tokyo) |
| Licensed payment provider | Transaction data and card details (we never see card numbers) | Thailand |
| Email delivery provider (Resend) | Your email address and order notification content | United States |
| Cloudflare | Signals used to check that a form was not sent by a bot | United States (global network) |
| Google Fonts | Your browser's IP address when the site's fonts load | United States |
Transfers abroad rely on each provider's terms of service and data processing agreement, which require them to process data only on our instructions or for the stated purpose of their service, with security safeguards in place.
We may also disclose data when legally required, or when necessary to prevent danger to life.
5. Share cards and private links
The card you can save and share never contains your question or your personal reading — only the card image and a short general message written in advance for that card.
Website order pages can only be opened through a private link. It is not indexed by search engines and we store it only in encoded form. Please don't share your link with others. The full text of your reading is sent only to your private LINE chat — it is never shown on the website.
Reviews on the website are published only with the customer's permission, use initials, and never include anyone's question or personal reading. Ask us at any time to remove yours.
6. How long we keep data
- Service data, readings and email: 2 years from your last use of the service
- Accounting and tax records, including refund records: 5 years, as required by law
- Wellbeing care records: 1 year, for continuity of care
- Anti-spam data (hashed IP): no more than 30 days
Your order-page link works for as long as we keep the data above (re-downloading digital cards follows section 6 of the Terms of Service). After that, we delete the data or make it impossible to identify you, and the link stops working.
7. Your rights
Under the PDPA you have the right to:
- Access your data and receive a copy
- Correct data that is inaccurate or out of date
- Delete your data
- Restrict the use of your data temporarily
- Object to certain processing
- Port your data to another controller
- Withdraw consent at any time
Email montratarotmkt@gmail.com to use any of these rights. We act within 30 days, free of charge.
If you ask us to delete everything, we can no longer serve you and your reading history is gone for good, except accounting records we are legally required to keep.
8. Security
- All data in transit is encrypted with HTTPS
- Database access is limited to people who need it
- Card files for sale are kept in private storage and downloaded only through temporary links
- Automatic daily backups
- Two-factor authentication for admin access
If a data breach poses a high risk to your rights, we will notify you and Thailand's Personal Data Protection Committee within 72 hours.
9. Cookies and browser storage
This website does not use cookies for tracking or advertising.
- The site remembers your most recent order links in your browser (local storage) so you can find them again. This stays on your device, is never sent to us, and can be removed by clearing site data in your browser.
- The card-reveal page inside LINE and the order page on this site use only temporary session storage — for example, remembering that you've already turned your cards over — which disappears when you close the tab.
10. Minors
The service is for people aged 18 and over. We do not intend to collect data from minors; if we find we have done so by mistake, we delete it immediately, except accounting records we are legally required to keep. Parents or guardians can contact us at the email above.
11. Changes to this policy
For material changes we will notify you in advance by LINE or by the email you gave us, and we always update the date at the top of this page.
12. Contact and complaints
Email montratarotmkt@gmail.com
LINE Official Account @061wprmv
If you are unhappy with how we handle your data, you may complain to Thailand's Office of the Personal Data Protection Committee (PDPC).